Marriott's Starwood reservation database breach exposed 500 million guests including passport numbers. Multiple settlement tracks are open — including identity-theft reimbursement and free credit monitoring.
Marriott acquired Starwood in 2016 and inherited a compromised reservation database that had been breached since 2014. The exposure included passport numbers (5 million unencrypted), payment cards, addresses, and birth dates of approximately 500 million guests. The FTC reached a consent decree; civil class actions and individual reimbursements are ongoing.
Marriott disclosed in November 2018 that the Starwood guest reservation database had been compromised since 2014, exposing data of about 339 million guests (the initial 500M estimate was later revised downward). Exposed data included payment-card information, addresses, dates of birth, and more than 5 million unencrypted passport numbers across Marriott, Starwood, Sheraton, Westin, W Hotels, St. Regis, and Le Méridien properties.
Civil cases were consolidated as MDL 2879 in the District of Maryland and settled in late 2024 with free credit monitoring, identity restoration, and reimbursement of documented out-of-pocket losses (including passport replacement). The Federal Trade Commission separately reached a consent order in October 2024 requiring data-deletion mechanisms and security improvements; the FTC order does not include monetary payments to consumers.
What was exposed, where the cases stand, and what consumers can claim:
The civil settlement provides credit monitoring, identity restoration, and reimbursement for documented losses (including passport replacement). The eligibility check above confirms whether you're in the class.
Two tracks: the civil class settlement (MDL 2879) and the separate FTC consent order. The FTC order does not include direct consumer payments; the civil settlement does.
| Diagnosis or claim type | Projected payout range | What drives the tier |
|---|---|---|
| Documented identity-theft loss reimbursement | Up to $5,000 | Civil class settlement. Out-of-pocket costs related to identity theft or fraud tied to the breach, with documentation. |
| Time-spent reimbursement | $67 per hour | Civil class settlement. Compensates time spent remedying the breach, with self-certification for limited hours and supporting docs above the threshold. |
| Passport replacement reimbursement | Up to $200 (or replacement cost) | For class members whose passport numbers were among the 5+ million unencrypted in the breach. |
| Free credit monitoring | Multi-year coverage | Provided through the settlement-designated credit-monitoring vendor for the program's duration. |
| FTC consent order (no consumer payments) | $0 direct payment | The FTC consent order requires security improvements and a data-deletion mechanism but does not include monetary payments to consumers. |
Civil settlement figures are as published by the court-appointed administrator. Documented-loss thresholds vary; review the official settlement notice for specifics.
Gather any record of stays between 2014 and Sept 2018 at Marriott, Starwood, Sheraton, Westin, W Hotels, St. Regis, or Le Méridien. Reservation confirmations, loyalty-account records, or credit-card statements all work.
10 to 30 minutes.The official settlement administrator's site (marriottdatabreach.com) helps verify class inclusion. The eligibility check above routes you there.
Class members are eligible for free credit monitoring through the settlement-designated vendor. Enrollment is via the official settlement site.
Free, enrollment under 10 minutes.Documented identity-theft costs and passport replacement costs can be submitted with supporting records. Check the current claim windows at the official site.
Window timing varies; check the administrator's site for current deadlines.Civil settlement claim windows and credit-monitoring enrollment have specific dates that change over time. The official site is the authoritative source for current windows.
Settlement windows shift. The eligibility check above routes you to the official administrator for current status and any open claim windows.
claimscout is not the settlement administrator and is not a law firm. We route you to the official sources and help you understand what is available.
marriottdatabreach.com.claimscout is not affiliated with Marriott, the settlement administrator, the FTC, or any state attorney general's office. We provide informational matching only.
Starwood, Sheraton, Westin, W Hotels, Marriott itself — if you stayed at any of these properties between 2014 and 2018, you're in the class. Passport numbers and credit cards were exposed.
Marriott, Starwood, Sheraton, Westin, W Hotels, St. Regis, Le Méridien, Aloft, and the Marriott-owned timeshare and loyalty programs that integrated with the Starwood reservation database.
About 339 million guest records: names, addresses, phone numbers, email addresses, passport numbers (5+ million in unencrypted form), Starwood Preferred Guest account info, dates of birth, and in some cases payment card information.
If your passport number was exposed and you replaced your passport because of the breach, you can claim passport-replacement reimbursement under the civil settlement.
They are separate proceedings. The civil class action (MDL 2879) is plaintiff-driven and provides money to class members. The FTC consent order is regulator-driven and requires Marriott to fix its security and offer data deletion; it does not include consumer payments.
No. The breach window for the Starwood reservation database was 2014 through September 2018. Stays after that are outside the class definition.
Common, and not necessarily disqualifying. Credit-card statements, frequent-traveler-program records, and email confirmations all help verify inclusion. The administrator's lookup tool is the fastest path.
Yes. The Oct 2024 FTC consent order requires Marriott to provide US consumers an ongoing way to request data deletion. Look for the data-deletion request mechanism on Marriott's site or via the FTC's enforcement page.
No. The official administrator runs marriottdatabreach.com. claimscout is an informational matching service that routes you to the official sources.
Nothing. We get paid by the law firms or affiliate fees from the court-appointed administrator. You pay zero up front and zero out of any payout you receive.
Only if you check the consent box. We give you the choice. If you do not consent, your claim is captured and we route it to the administrator directly without sharing your phone number.
Yes, always. If we route your claim to a law firm, you can choose to file directly with the same firm or pick a different one. We exist because most people throw the notice letter away. We make it not happen.
No. We are not a law firm and do not provide legal advice. We are a platform that captures your claim, qualifies it, and routes it to the court-appointed administrator or a law firm of your choice.